The Drag and Drop Multiple File Upload for Contact Form 7 plugin fails to escape a configuration setting that is used as an HTML tag name in front‑end output. This oversight permits a user with administrator privileges to inject arbitrary scripts that run client‑side whenever the upload field is rendered. The stored XSS can be leveraged to steal session cookies, deface the site, or perform other malicious client‑side actions, impacting confidentiality and integrity of user data.

WordPress sites that have the Drag and Drop Multiple File Upload for Contact Form 7 plugin installed at a version earlier than 1.3.9.9. The affected vendor/product is unknown but is identified as the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin.

The issue requires administrator access to modify the vulnerable setting, but the injected script runs in the browsers of any visitors to a page that displays the upload field. Because the vulnerability is a stored XSS rather than an authentication bypass, the potential exposure can affect all site users. No public exploit is reported, but the EPSS score is unavailable and the vulnerability is not listed in CISA KEV, indicating it is not currently widely exploited. Nevertheless, the high potential impact warrants prompt remediation.